---
title: "Stepup Validate"
method: POST
path: "/pws/validate/"
tags: ["VCAS"]
---

# Stepup Validate

`POST /pws/validate/`

## Request

- Base URL: `https://api.uat.paymentology.com/ppws/api`
- URL: `https://api.uat.paymentology.com/ppws/api/pws/validate/`
- Auth: none declared

Stepup Validate request is communicate by the VCAS platform to the partner, and the partner responds with a success,failure or retry logic.

## Request body

- ValidateRequest
  - `CredentialResponse` CredentialValidate[], required: Credential response information for validation
    - `Id` string: Id value from the StepupResponse->Credential. Length will be 36 Characters.
    - `Type` 'OTPEMAIL' | 'OTPSMS' | 'OTPIVR' | 'KBASINGLE' | 'KBAMULTI (May be supported in future versions of VCAS)' | 'BIOMETRIC' | 'OUTOFBANDOTHER': Type of the Credential used for stepup, this is meta data and will not be used in any business logic
    - `Value` string: Value provided by the cardholder.
  - `IssuerId` string, required: Cardinal provided identifier for the partner. Length - Up to 24 Characters
  - `MessageVersion` string, required: Version of the message based on 3DS spec. Examples - 1.0.2, 2.1.0, 2.2.0
  - `ProcessorId` string, required: Cardinal provided identifier for the partner. Length - Up to 24 Characters
  - `StepupCounter` integer, required: Counter for tracking the number of Stepups. Each stepup can go from Stepup -> InitiateAction -> Validate. If the user requests a "resend" via the browser templates it will initiate another Stepup request.
  - `StepupRequestId` string, required: Unique identifier to identify the particular Stepup request. Length will be 36 Characters.
  - `TransactionId` string, required: VCAS generated transaction reference id. Length - Up to 36 Characters. 3DS 1.0.2 - 28 character alpha-numeric. EMV 3DS - 36 character GUID.
  - `DSTransactionId` string: Directory Server (DS) generated transaction reference id. GUID Format. Note: EMV 3DS Transactions only
  - `StepupType` 'CHOICE' | 'OTP' | 'KBA' | 'BIOMETRIC' | 'OUTOFBAND' | 'OTP_AND_KBA' | 'OTP_CHOICE_AND_KBA': Used to identify what type of stepup.
  - `FirstFactorOutcome` 'SUCCESS' | 'FAILURE' | 'RETRY' | 'PENDING' | 'FAILWITHFEEDBACK' | 'BLOCKED' | 'REJECTED' | 'ATTEMPTS': Will provide the outcome of the first authentication. Success, Failure, and Retry should be the only valid values. However, a status of Pending, FailWithFeedback, Blocked, Rejected, and Attempts can be returned if an Issuer returned one of these Status on the first RDX Validate response.
  - `RDXMessageVersion` string: Version of the RDX protocol being used. This will be used to enable new features without breaking current integrations. Example: 2.2.0 and 2.2.1
  - `BehavioralBiometricsResult` BehavioralBiometricsResult: The RDX Behavioral Biometrics solution is not generally available but will be released at a future date.
    - `CustomerId` string
    - `Decision` string
    - `RiskScore` string

## Response `200`

Successful Response

- ValidateResponse
  - `IssuerId` string, required: Echoed from Request. Length - Up to 24 Characters
  - `ProcessorId` string, required: Echoed from Request. Length - Up to 24 Characters
  - `Status` 'SUCCESS' | 'FAILURE' | 'RETRY' | 'PENDING' | 'BLOCKED' | 'STEPUP' | 'ERROR' | 'ATTEMPTS' | 'FAILWITHFEEDBACK' | 'REJECTED' | 'FAIL' | 'CHALLENGE' | 'AUTHENTICATED', required: ERROR is returned on any interal/technical issues. ATTEMPTS is only supported for 1.0.2 transactions. REJECTED is only supported for 2.x.x transactions. AUTHENTICATED will return a Y back to merchant
  - `StepupRequestId` string, required: Echoed from Request. Length - 36 Characters
  - `TransactionId` string, required: Echoed from Request. Length - Up to 36 Characters
  - `Language` string: Language to display the instructions and prompt to the cardholder. This value will decide which template is loaded, provided the correct template language is available. If not provided, the language is selected based on Issuer configuration and browser preference e.g. en-US. Length - Up to 8 Characters
  - `Reason` Reason: An object that can be used for sending a status code and description.
    - `ReasonCode` string: Used by the issuer for informational purposes. Length - Up to 32 Characters
    - `ReasonDescription` string: Used by the issuer for informational purposes. Length - Up to 256 Characters
  - `Error` ErrorMessage: An object that can be used to convey an error message on the response.
    - `ReferenceNumber` string: System reference number for the error message. Length - Up to 15 Characters
    - `Description` string: A description of the error. Length - Up to 50 Characters
    - `Message` string: A message that will be displayed to the customer on the error screen. Length - Up to 100 Characters
    - `ReasonDescription` string: Used by the issuer for informational purposes. Up to 256 characters.
  - `CredentialId` string: ID value from StepupResponse->Credential. Length - 36 Characters
  - `RiskIndicator` string: If returned, this value will be used in the creation of certain Authentication Values (AV) for EMV 3DS. The value passed must conform to the current AV value the Issuer is using. This may also depend on the card brand of the transaction. For example, CAVV and IAV accept different values. On Challenge responses (Stepup, Initiate, Validate) this value is currently ignored for CAVV usages in favor of mapping to the 'Credential Type'. For Enhanced IAV SPA2 usage, if passed, this value will override the mapping to the 'Credential Type'. Note: This field is only available for EMV 3DS transactions and not available on 3DS 1 transactions Note: The value here will be converted to the Hexadecimal equivalent. Please see 'VCAS Enhanced AV' document for more details on current AVs available and the corresponding values.
  - `TransStatusReason` string: Provides information on why the Transaction Status field has the specified value.
  - `RReqOverrides` RReqOverrides: For the Embedded OOB flow, the StepupType for this transaction is OUTOFBAND_EMBEDDED. For this flow, RReqOverrides is a required object on the Validate Response.
    - `AuthenticationMethod` string
    - `TransStatusReason` string
    - `AuthenticationAttempts` string
    - `CustomerCancel` string

## Other responses

- `404`: Webservices does not exist
- `500`: Internal Server error

## Changes

- **2026-11-03** `73c2771493b1`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/paymentology/apis/payapi-docs/changes/pws/validate/post.md)

---

[API](https://skmtc.dev/paymentology/apis/payapi-docs.md) - [All operations](https://skmtc.dev/paymentology/apis/payapi-docs/llms.txt) - [OpenAPI document](https://skmtc.dev/paymentology/apis/payapi-docs/revisions/73c2771493b1?raw)